Privacy Policy

Last Updated: April 1, 2026

1. Introduction

Stabil ("we," "us," or "our") operates the Stabil Wallet mobile application (the "App"), a self-custody cryptocurrency wallet available on Apple's App Store for iOS devices. This Privacy Policy explains how we collect, use, store, and protect information when you use our App. By downloading, installing, or using Stabil Wallet, you acknowledge that you have read and understood this Privacy Policy.

Stabil Wallet is designed with a privacy-first architecture. We believe that your financial data belongs to you alone. Our App is built so that we have zero access to your private cryptographic material, and we collect the absolute minimum amount of data necessary to provide our services.

2. Information We Collect

2.1 Information You Provide

When you use Stabil Wallet, you may voluntarily provide the following information:

• Wallet names: Custom labels you assign to your wallets for personal organization.
• Contact names and addresses: Names and blockchain addresses you add to your address book for convenience.
• Display preferences: Your chosen theme (light or dark mode), preferred fiat currency for balance display, and other user interface settings.

2.2 Automatically Generated Information

The following information is generated or retrieved automatically as part of the App's core functionality:

• Wallet addresses: Public blockchain addresses derived locally on your device from your cryptographic keys. These addresses are necessary to interact with blockchain networks.
• Transaction records: Transaction history fetched from public blockchain networks. This data is already publicly available on the respective blockchains; the App merely retrieves and displays it for your convenience.
• Token balances: Current balances of your tokens and coins, queried from blockchain Remote Procedure Call (RPC) endpoints. These queries use your public wallet addresses only.

2.3 Information We Do NOT Collect

Stabil Wallet is a self-custody wallet. This means that the following sensitive information is never collected, transmitted to our servers, or accessible to us in any way:

• Private keys: Your private cryptographic keys are generated and stored exclusively on your device. We have zero access to them.
• Mnemonic (recovery) phrases: Your seed phrase is generated locally and never leaves your device unless you explicitly export it.
• PINs and passwords: Your authentication credentials are hashed and stored locally on your device. We cannot retrieve or reset them.
• Biometric data: Fingerprint and facial recognition data is processed entirely by the iOS operating system. The App only receives a success or failure response from the system's biometric framework.
• Personal identification: We do not require or collect your name, email address, phone number, government-issued identification, or any other personally identifiable information to use the App.

3. How Your Data Is Stored

3.1 Local Storage

All sensitive data is stored locally on your device using industry-leading security mechanisms provided by Apple's iOS platform. We employ a multi-layered storage architecture that ensures each type of data receives an appropriate level of protection:

• iOS Keychain (hardware-backed): Cryptographic keys and highly sensitive credentials are stored in the iOS Keychain, which leverages the device's Secure Enclave hardware for protection. This data is encrypted at the hardware level and is inaccessible to other applications or to us.
• Encrypted SQLite database (GRDB): Wallet metadata, transaction history, and address book entries are stored in an encrypted SQLite database using the GRDB framework with AES-256-GCM encryption.

3.2 Four-Tier Data Classification

We implement a strict four-tier data classification system to ensure that each category of data receives the appropriate level of security:

• Tier 1 -- Keychain: Private keys, mnemonic phrases, and authentication tokens are stored in the iOS Keychain with hardware-backed encryption via the Secure Enclave.
• Tier 2 -- Encrypted Database: Wallet metadata, transaction records, contact information, and address book entries are stored in an AES-256-GCM encrypted SQLite database.
• Tier 3 -- UserDefaults: Non-sensitive preferences such as theme selection, display currency, and notification settings are stored in iOS UserDefaults.
• Tier 4 -- Memory Only: Decrypted private keys and sensitive session data exist only in volatile memory during active use and are securely zeroed out when no longer needed. This data is never written to persistent storage in its decrypted form.

3.3 Cloud Sync (Optional)

Stabil Wallet offers an optional cloud synchronization feature powered by Supabase. If you choose to enable this feature, the following applies:

• Only wallet metadata (such as wallet names and public addresses) is synchronized. Your private keys, mnemonic phrases, and authentication credentials are never transmitted to or stored on any remote server.
• Cloud sync uses anonymous authentication. No personal account creation, email address, or identifying information is required.
• You may disable cloud sync at any time and delete all remotely stored data by wiping your app data.

3.4 iCloud Backup (Optional)

Stabil Wallet provides an optional, user-initiated backup feature via Apple iCloud. If you choose to create a backup:

• Your backup data is encrypted locally on your device using AES-256-GCM encryption with a password that you choose before it is uploaded to iCloud.
• We do not have access to your backup password. If you lose your password, we cannot decrypt or recover your backup data.
• iCloud backups persist in your iCloud account until you manually delete them.

4. Third-Party Services

Stabil Wallet integrates with select third-party services to provide core functionality such as blockchain data retrieval, exchange rate information, and decentralized exchange access. We have carefully chosen these providers and limit the data shared with each to the minimum necessary for their respective functions.

4.1 ANKR

We use ANKR's blockchain RPC infrastructure to query token balances and transaction data from supported blockchain networks. Only your public wallet addresses are transmitted to ANKR's endpoints. ANKR receives publicly available blockchain data and does not receive any private keys, personal information, or authentication credentials.

4.2 Coinbase

We use Coinbase's public API to retrieve real-time and historical exchange rate data for cryptocurrency price display. No wallet addresses, transaction data, or personal information is shared with Coinbase through this integration.

4.3 Supabase

If you enable the optional cloud sync feature, Supabase is used to store wallet metadata (names, public addresses) using anonymous authentication. No private keys, mnemonic phrases, or personal identification data is transmitted to Supabase. You can review Supabase's privacy practices at supabase.com/privacy.

4.4 Decentralized Exchange (DEX) Aggregators

Stabil Wallet integrates with multiple DEX aggregation services to provide you with competitive swap quotes. When you request a swap quote, the following services may receive your public wallet address for the purpose of generating a quote:

• Li.Fi: Cross-chain bridging and swap aggregation.
• 1inch: DEX aggregation for optimal swap routing.
• Paraswap: Multi-DEX swap aggregation.
• 0x (Zero Ex): DEX liquidity aggregation protocol.
• Jupiter: Solana ecosystem swap aggregation.
• Relay: Cross-chain bridging and transaction relay.

These services receive your public wallet address solely for the purpose of generating swap quotes and executing transactions you explicitly approve. None of these services receive your private keys, mnemonic phrases, or any personal identification information.

4.5 Flashbots

For transactions submitted on the Ethereum mainnet, Stabil Wallet uses Flashbots to provide MEV (Maximal Extractable Value) protection. Flashbots ensures that your transactions are not front-run or sandwich-attacked by malicious actors. Only your signed transaction data (which is publicly broadcast to the network upon confirmation) is shared with Flashbots. No private keys or personal information is transmitted.

4.6 WalletConnect (Reown)

Stabil Wallet supports the WalletConnect protocol (powered by Reown) to enable connections with decentralized applications (dApps). When you connect to a dApp via WalletConnect, your public wallet address and chain information are shared with the connected dApp as required by the protocol. You maintain full control over which transactions to approve and can disconnect from any dApp at any time.

Important: None of the third-party services listed above receive your private keys, mnemonic phrases, PINs, or biometric data at any time. We encourage you to review the privacy policies of these third-party providers for additional information about their data practices.

5. Blockchain Data

Transactions conducted on public blockchain networks (such as Ethereum, Bitcoin, Solana, and others supported by Stabil Wallet) are inherently public and permanently recorded on their respective blockchains. This is a fundamental characteristic of blockchain technology and is not specific to Stabil Wallet.

Stabil Wallet does not add any identifying information to your blockchain transactions. Your transactions contain only the data required by the blockchain protocol (sender address, recipient address, amount, and gas fees). We do not embed analytics identifiers, tracking pixels, or any other metadata into your transactions.

The App provides block explorer links for your transactions to enable you to independently verify their status and details on the public blockchain. These links direct you to third-party block explorer websites, which are governed by their own privacy policies.

6. Notifications

Stabil Wallet may send you notifications regarding transaction confirmations, price alerts, and other wallet-related events. All notifications are generated and triggered locally on your device during the App's routine synchronization process.

Our notification system operates with the following privacy safeguards:

• Notifications are processed entirely on your device. No notification data is sent to our servers or any third-party push notification service.
• Only public keys and transaction counts are used for monitoring purposes. Transaction amounts, balances, and other financial details are never included in notification processing logic.
• You can disable notifications at any time through the App's settings or through your device's iOS notification settings.

7. Data Retention

Stabil Wallet retains data according to the following principles:

• Local data: All data stored locally on your device persists until you explicitly delete it, uninstall the App, or use the "Erase All Data" function in the App's settings. We do not have the ability to remotely delete or modify data on your device.
• Cloud sync data: If you have enabled optional cloud synchronization, remotely stored wallet metadata can be deleted at any time by wiping your app data through the App's settings. Upon deletion, this data is permanently removed from Supabase's servers.
• iCloud backups: Encrypted backup files stored in iCloud persist until you manually delete them from your iCloud account. Apple's data retention policies govern the storage of these files within iCloud. We have no access to or control over your iCloud backups.

8. Your Rights

We believe in giving you complete control over your data. As a user of Stabil Wallet, you have the following rights:

8.1 Right of Access

You can view all data associated with your wallets at any time directly within the App. Because your data is stored locally on your device, you have immediate and unrestricted access to it without needing to submit a data access request.

8.2 Right of Deletion

You can permanently delete all data stored by Stabil Wallet at any time by navigating to Settings > Erase All Data within the App. This action will irreversibly remove all local data including wallets, transaction history, contacts, and preferences. If cloud sync is enabled, remotely stored metadata will also be deleted.

8.3 Right of Portability

You can export your recovery phrase (mnemonic) or individual private keys at any time through the App's export functionality. This enables you to migrate your wallets to any other compatible cryptocurrency wallet application. Your cryptographic keys are standard and interoperable with other wallets that support the same derivation paths and blockchain networks.

8.4 No Account Required

Stabil Wallet is fully functional without creating any account, providing any email address, or sharing any personal identification. The App's core features -- including wallet creation, transaction management, and token swaps -- are available without registration of any kind.

9. Security Measures

We employ a comprehensive suite of security measures to protect your data at rest, in transit, and during active use:

• AES-256-GCM encryption: All sensitive data stored in the local database is encrypted using the Advanced Encryption Standard with 256-bit keys in Galois/Counter Mode, providing both confidentiality and data integrity.
• PBKDF2-HMAC-SHA256 key derivation: Your PIN is hashed using PBKDF2 with HMAC-SHA256 and a minimum of 100,000 iterations, making brute-force attacks computationally infeasible.
• iOS Keychain with hardware-backed protection: Cryptographic keys are stored in the iOS Keychain, leveraging the device's Secure Enclave for hardware-level isolation and protection.
• Biometric authentication with enrollment change detection: When biometric authentication is enabled, the App detects changes to the device's biometric enrollment (such as new fingerprints being added) and requires re-authentication to prevent unauthorized access.
• Constant-time comparison: Sensitive data comparisons (such as PIN verification) use constant-time algorithms to prevent timing side-channel attacks that could leak information about your credentials.
• App switcher content blurring: When you switch away from Stabil Wallet, the App automatically obscures its content in the iOS app switcher using SecureFieldModifier, preventing sensitive information from being visible in multitasking views or screenshots.

10. Children's Privacy

Stabil Wallet is not intended for use by individuals under the age of 17. We do not knowingly collect, solicit, or process any data from children. The App is rated 17+ on the Apple App Store in accordance with Apple's age rating guidelines for financial and cryptocurrency applications.

If you believe that a person under the age of 17 has used the App, please contact us at privacy@stabil.app. Because Stabil Wallet does not collect personal information, our ability to identify individual users is inherently limited; however, we will take all reasonable steps to address your concern.

For more information about our age requirements, please refer to our Age Suitability Policy.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will revise the "Last Updated" date at the top of this page and publish the updated policy at this URL.

We encourage you to review this Privacy Policy periodically for any changes. Your continued use of Stabil Wallet after the posting of changes constitutes your acceptance of such changes. If we make material changes that significantly affect how we handle your data, we will make reasonable efforts to notify you through the App or other appropriate channels.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please do not hesitate to contact us:

• Email: privacy@stabil.app
• Website: https://stabil.app/support
• Contact form: Visit our contact page

We are committed to resolving any privacy-related concerns promptly and transparently. We will respond to all legitimate inquiries within a reasonable timeframe.